> ## Documentation Index > Fetch the complete documentation index at: https://www.plain.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Security at Plain > How Plain stores and protects your data, which certifications it holds, and who to contact about security. This section collects the security commitments Plain makes about your data: where it is stored, who can reach it, what happens when AI features are on, and how to report a vulnerability. If your team needs something that isn't here, email [security@plain.com](mailto:security@plain.com). ## Certifications and compliance Plain is SOC 2 Type II certified. Independent audits verify how Plain manages security, availability, and confidentiality. Plain's systems are built in line with the General Data Protection Regulation (GDPR) and the UK Data Protection Act. A [Data Processing Agreement (DPA)](https://www.plain.com/legal/dpa) is available for companies that need one. To request the SOC 2 report or other security documentation, go to [trust.plain.com](https://trust.plain.com). Current system health is at [status.plain.com](https://status.plain.com). ## How data is stored All data is encrypted in transit and at rest. Plain runs on Amazon Web Services in the `eu-west-2` (London) region. Backups run on a regular schedule and are encrypted at rest. Engineers, systems, and roles get the least privilege needed to do their work. Every change to infrastructure, permissions, and code goes through code review. Administrator privileges are used only during serious incidents; routine maintenance runs through roles with fine-grained permissions. ## How the API is protected Every API request requires authentication. Requests Plain makes to your endpoints can be verified two ways: * **[Request signing](/docs/request-signing)**: outbound requests to your webhook targets and customer card endpoints carry an HMAC-SHA256 signature made with a shared secret. * **[mTLS](/docs/mtls)**: outbound requests present a client certificate you can verify against Plain's CA certificate. ## Third-party vendors Plain reviews every third-party vendor before using it, and reviews what data each vendor can reach on an ongoing basis. The full list of sub-processors is in the [DPA](https://www.plain.com/legal/dpa). The AI providers Plain uses are covered separately in [AI and your data](/docs/product/security/ai-and-your-data), including Plain's zero data retention commitments. ## Your privacy rights The [Privacy Policy](https://www.plain.com/legal/privacy-policy) and the [DPA](https://www.plain.com/legal/dpa) set out what data Plain collects and how it is used. You can request, access, or delete your data at any time, and Plain never shares your data without consent. ## When workspaces are deleted A workspace with no activity for 6 months and no active billing subscription is deleted automatically. Workspace owners get an email first, and deletion goes ahead 14 days later unless an owner replies to cancel it. To request a manual deletion, email [support@plain.com](mailto:support@plain.com). Plain support will ask you to confirm your identity before proceeding. Workspace deletion is final. Deleted workspaces and their data cannot be recovered. ## Reporting a security issue Email [security@plain.com](mailto:security@plain.com). Keep the report concise, include steps to reproduce, and add a proof of concept if you can. Valid reports are acknowledged within 48 hours. If you are testing Plain as a security researcher, read the [responsible disclosure policy](/docs/product/security/responsible-disclosure) first. It sets out the rules research must stay inside, what Plain commits to, and when a bounty is paid.